Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authorization header on redirect #701

Open
speeddragon opened this issue Feb 20, 2022 · 0 comments
Open

Authorization header on redirect #701

speeddragon opened this issue Feb 20, 2022 · 0 comments

Comments

@speeddragon
Copy link

speeddragon commented Feb 20, 2022 •
edited
Loading

Hackney send authorization header on redirect, similar issue as CVE-2018-1000007 in cURL.

cURL uses the flag --location-trusted. Should we implement something like this?

This can be seen on redirect to S3 from an API that needs Authorization.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@speeddragon